CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,244 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-1374 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication o… | Patch early | 6.8 medium | 1% | 2015-01-27 |
| CVE-2010-0707 EXP | Cross-site request forgery (CSRF) vulnerability in add_user.php in Employee Timeclock Software 0.99 allows remote attackers to hijack the authenticati… | Patch early | 6.8 medium | 1% | 2010-02-25 |
| CVE-2017-7953 EXP | INFOR EAM V11.0 Build 201410 has XSS via comment fields. | Patch early | 5.4 medium | 1% | 2017-05-16 |
| CVE-2009-2164 EXP | Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 1% | 2009-06-22 |
| CVE-2012-1414 EXP | Cross-site request forgery (CSRF) vulnerability in manager/news.php in Plume CMS 1.2.4 and earlier allows remote attackers to hijack the authenticatio… | Patch early | 6.8 medium | 1% | 2012-10-07 |
| CVE-2012-5326 EXP | Cross-site request forgery (CSRF) vulnerability in admin/function.php in IDevSpot iSupport 1.x allows remote attackers to hijack the authentication of… | Patch early | 6.8 medium | 1% | 2012-10-08 |
| CVE-2007-0267 EXP | The ufs_lookup function in the Mac OS X 10.4.8 and FreeBSD 6.1 kernels allows local users to cause a denial of service (kernel panic) and possibly cor… | Patch early | 6.6 medium | 1% | 2007-01-17 |
| CVE-2025-51397 EXP | A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scri… | Patch early | 5.4 medium | 1% | 2025-07-21 |
| CVE-2001-0594 EXP | kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument… | Patch early | 4.6 medium | 1% | 2001-08-02 |
| CVE-2010-5024 EXP | SQL injection vulnerability in manage/add_user.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote authenticated users, with Read privileges, to execute… | Patch early | 6.0 medium | 1% | 2011-11-02 |
| CVE-2008-6725 EXP | Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1)… | Patch early | 6.0 medium | 1% | 2009-04-17 |
| CVE-2011-1496 EXP | tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line… | Patch early | 4.6 medium | 1% | 2011-04-18 |
| CVE-2014-2851 EXP | Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service… | Patch early | 6.9 medium | 1% | 2014-04-14 |
| CVE-2009-4732 EXP | SQL injection vulnerability in tt/index.php in TT Web Site Manager 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrar… | Patch early | 6.8 medium | 1% | 2010-03-18 |
| CVE-2010-4517 EXP | SQL injection vulnerability in the JExtensions JE Auto (com_jeauto) component 1.0 for Joomla!, when magic_quotes_gpc is disabled, allows remote attack… | Patch early | 6.8 medium | 1% | 2010-12-09 |
| CVE-2007-4602 EXP | SQL injection vulnerability in cms/revert-content.php in Implied by Design Micro CMS (Micro-CMS) 3.5 allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 1% | 2007-08-31 |
| CVE-2008-6241 EXP | Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attacker… | Patch early | 6.8 medium | 1% | 2009-02-23 |
| CVE-2009-2018 EXP | SQL injection vulnerability in admin/index.php in Jared Eckersley MyCars, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitr… | Patch early | 6.8 medium | 1% | 2009-06-09 |
| CVE-2009-2023 EXP | SQL injection vulnerability in index.php in Shop-Script Pro 2.12, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 1% | 2009-06-09 |
| CVE-2009-2167 EXP | Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow rem… | Patch early | 6.8 medium | 1% | 2009-06-22 |
| CVE-2010-0832 EXP | pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubun… | Patch early | 6.9 medium | 0.9% | 2010-07-12 |
| CVE-2009-3975 EXP | SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and 1.2.0 allows remote attackers to execute arbitrary SQL commands via the gallery_id p… | Patch early | 6.8 medium | 0.9% | 2009-11-18 |
| CVE-2011-3479 EXP | Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), uses world-writable perm… | Patch early | 6.8 medium | 0.9% | 2012-01-25 |
| CVE-2008-0714 EXP | SQL injection vulnerability in users.php in Mihalism Multi Host allows remote attackers to execute arbitrary SQL commands via the username parameter i… | Patch early | 6.8 medium | 0.9% | 2008-02-12 |
| CVE-2008-1911 EXP | SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magic_quotes_gpc is disabled, allows remote attackers to e… | Patch early | 6.8 medium | 0.9% | 2008-04-22 |
| CVE-2008-2479 EXP | Multiple SQL injection vulnerabilities in phpFix 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) kind parameter to fix/browse… | Patch early | 6.8 medium | 0.9% | 2008-05-28 |
| CVE-2008-2522 EXP | SQL injection vulnerability in members.php in Battle.net Clan Script for PHP 1.5.3 and earlier, when magic_quotes_gpc is disabled, allows remote attac… | Patch early | 6.8 medium | 0.9% | 2008-06-03 |
| CVE-2008-3133 EXP | SQL injection vulnerability in admin/index.php in BareNuked CMS 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 0.9% | 2008-07-10 |
| CVE-2008-4091 EXP | SQL injection vulnerability in index.php in Web Directory Script 1.5.3 allows remote attackers to execute arbitrary SQL commands via the site paramete… | Patch early | 6.8 medium | 0.9% | 2008-09-15 |
| CVE-2008-5000 EXP | SQL injection vulnerability in admin/includes/news.inc.php in PHPX 3.5.16, when magic_quotes_gpc is disabled, allows remote attackers to execute arbit… | Patch early | 6.8 medium | 0.9% | 2008-11-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt